aml-chain-guard[.]icu

The domain aml-chain-guard.icu is identified as a generic phishing site targeting users under the guise of an anti-money laundering (AML) compliance and blockchain monitoring platform. Analysis indicates this infrastructure was designed to deceive individuals or organizations seeking legitimate AML solutions, potentially harvesting credentials or distributing malicious payloads. The domain is currently offline, though prior activity suggests it may have been operational for a limited period. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.181.97, a host with a history of supporting malicious activity. The domain appears on two security blocklists and is flagged by 5 of 95 security vendors on VirusTotal, including detections for phishing and fraudulent behavior. Additional indicators include a Gridinsoft trust score of 0/100 and prior inclusion in one AlienVault OTX threat intelligence pulse. The page title, 'AML Chain Guard - Secure Blockchain Monitoring,' further supports the impersonation of a legitimate AML service. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active phase. Organizations are advised to review logs for connections to 172.67.181.97 or the domain itself, particularly in environments where AML or blockchain monitoring tools are utilized. Blocking the domain and IP at the network perimeter is recommended as a precautionary measure. Users who accessed the site should rotate credentials for any associated accounts and monitor for unauthorized transactions or data exposure. Given the domain's creation date in the future (2026), this may indicate typosquatting or an attempt to exploit temporal confusion in domain registration.